The present invention relates generally to a virus detection system and method, and more particularly, to a system and method for limiting processor utilization by a virus scanner.
A huge surge in computer viruses has occurred in the last decade. Computer viruses have gone from an academic curiosity to a persistent, worldwide problem. Today, viruses affect vast numbers of computers in locations throughout the world. A computer virus is generally a manmade destructive computer program or code that is loaded onto a computer system without the knowledge of the user. The computer virus is often a self-replicating program containing code that explicitly copies itself and can infect other programs by modifying them or their environment. Even a simple virus can be dangerous as the virus can quickly use a large portion of the available memory and possibly bring down the computer system.
Viruses can be written for, and spread on, virtually any computing platform. A virus can infect, or become resident in almost any software component, including an application, operating system, system boot code, or device driver. Computer viruses spread by attaching themselves to other programs (e.g., word processing or spreadsheet applications) or to a boot sector of a disk. When an infected file is activated or executed, or when the computer is started from an infected disk, the virus is also executed and attempts to infect other files. Since a virus is software code, it can be transmitted along with any legitimate software that enters the computer environment. Some viruses are capable of transmitting themselves across networks and bypassing security systems. For example, a virus can spread to files on a local area network (LAN) based file server, and from there to other client systems attached to the server. Similarly, systems that run programs from wide area network (WAN) file servers can become infected if the programs on the server are susceptible to infection. In the networked world of the internet, viruses can rapidly spread.
The term virus generally refers to any destructible or harmful program or code that attempts to hide its possibly malicious function or tries to spread onto as many computers as possible. One common type of virus is a macro virus which is encoded as a macro embedded in a document. Many applications support macro languages which allow the user to embed a macro in a document and have the macro execute each time the document is opened. Once a computer system is infected with a macro virus, the virus can embed itself in all future documents created with the associated application.
Another common virus is a boot sector virus which replaces the computer system's master boot record with its own code. The boot sector virus is a small program executed each time a computer boots. The virus infects floppy disks and hard disks by inserting itself into the boot sector of the disk, which contains code that is executed during the system boot process. Since the master boot record executes every time the computer is started, the boot sector virus can be very dangerous to the integrity of the computer system. The boot sector virus typically enters the computer system through a floppy disk installed in the floppy drive when the computer system is started.
Another type of virus, which is often difficult to detect, is a polymorphic virus. This virus produces varied but operational copies of itself Code within the virus includes an encryption routine to help the virus hide from detection, plus a decryption routine to restore the virus to its original state when it executes.
A Trojan horse is another type of virus which masquerades as a legitimate software program. The Trojan horse generally does not replicate. It waits until its trigger event occurs and then displays a message or destroys files or disks.
A computer worm is another type of virus that can replicate itself and use memory but cannot attach itself to other programs. The computer worm is a self-contained program, or set of programs, that is able to spread functional copies of itself or its segments to other computer systems, usually via network connections. Host computer worms are entirely contained in the computer they run on and use network connections only to copy themselves to other computers. Network worms consist of multiple parts (called “segments”), each running on different machines and using the network for several communication purposes.
Many antivirus programs have become commercially available for protection against viruses. There are three main types of antivirus software: activity monitors, scanners, and integrity checkers. Activity monitoring programs attempt to prevent infection before it happens by looking for virus type activity, such as attempts to reformat a disk Scanners are the most widely used type of antivirus program. Virus scanners generally operate in batch mode, scanning all files on a system, hard disk, or floppy disk, when requested by the user, or at set intervals. They look for known viruses by searching disks and files for scan strings or patterns. A scanner may be designed to examine specified disks or files on demand, or it may be resident, examining each program that is about to be executed. Most scanning programs include an update feature that allows the antivirus program to download profiles of new viruses from the Internet so that the program can check for new viruses soon after they are discovered. Most scanners also include virus removers which are operable to clean infected files. One example of an antivirus scanner is McAfee's VSHIELD.
The third type of antivirus software, integrity checkers, compute a small checksum or hash value for files which are presumably uninfected, and later compare newly calculated values with the original ones to see if the files have been modified. These programs catch unknown viruses as well as known ones. As with scanners, integrity checkers may be called to check entire disks or they may be resident, checking each program that is about to be executed.
Most of the antivirus software available today, such as conventional device resident antivirus scanners, require a large amount of memory and processor resources. Virus scanners often perform their virus scanning operations while a user is working on the computer and running programs or applications that also utilize the computer's CPU (central processing unit). On-demand virus scanners may be configured, for example, to check a computer's hard drive on a scheduled basis or upon a user request. The on-demand virus scanner walks through a directory tree and passes each file to the virus scan engine to be scanned for viruses. Since the scan engine requires much of the CPU's resources, the on-demand scan processes running in the background often interfere with normal operation of the computer. Thus, the user has to either wait for the virus scanner to complete its scanning operation or work with slow running applications until the virus scan is complete.
One method for reducing CPU utilization by the scanner is to limit the rate at which the scanner walks a directory and passes files to the engine. However, some files require more processing resources than others, thus there may still be peaks in CPU utilization.
During the scanning process, the scanner may receive callbacks from the engine indicating, among other things, the progress the engine has made scanning each file. The scanner can use these callbacks as an opportunity to sleep, thus, self-limiting the amount of CPU it is using. However, the rate at which the callbacks occur is heavily dependent on the type of file being scanned. This method, therefore, does not provide a consistent reduction in CPU utilization.
There is, therefore, a need for a system and method for scanning files for viruses while limiting the amount of computer resources the scan engine utilizes to reduce interference with other applications running on the computer.